Catalog / Moby

docker 29.9.1

v29.9.1

todaysecurityaddedfixedOriginal notes

29.9.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

The containerd update to v2.4.2 includes fixes for the following security vulnerabilities:

  • CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest.
  • GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer.
  • GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.

Bug fixes and enhancements

  • Fix --link-local-ip accepting addresses that are not link-local (169.254.0.0/16 or fe80::/10) when creating a container or connecting it to a network, which made the container fail to start. moby/moby#53923
  • Fix COPY --from in the classic builder failing for files not owned by root when userns-remap is enabled. moby/moby#53859
  • Fix docker ps -s and container listing with sizes failing entirely when the size of one container cannot be computed. moby/moby#53921
  • Fix docker save leaving image layers on disk after the image is removed, when the image contains the same layer more than once (graph-driver image store). moby/moby#53927
  • Fix a daemon panic when using the fluentd log driver with a TLS address that cannot be connected to and fluentd-async enabled. moby/moby#53922
  • Fix image digest resolution failing when a registry mirror succeeds but a subsequent registry lookup fails. moby/moby#53933
  • Fix plugin privilege lookup reporting success when fetching the plugin fails. moby/moby#53934

Packaging updates

Networking

  • Don't add bridge network interfaces to firewalld's docker zone when iptables and ip6tables are both disabled. moby/moby#53907
  • Fix bridge networks failing to restore on daemon startup when their bridge is bound to a firewalld zone other than docker. moby/moby#53907

Rootless

  • Fix --domainname with user namespaces and rootless mode; this requires an OCI runtime supporting the domainname field (such as runc >= v1.2.0). moby/moby#53899
  • Update RootlessKit to v3.3.0. moby/moby#53942